# Targeted Espionage Campaign Against a Global Stock Exchange Executive via Incremental Outlook OST Mailbox Theft and Living-off-the-Land Cloud Exfiltration

> An unattributed threat actor ran a roughly five-month espionage operation (Oct 2025 - Mar 2026) against a senior figure at a major global stock exchange, stealing the victim's Outlook mailbox in small incremental batches by converting OST files to PST with an Aspose-based stealer and exfiltrating the data through legitimate cloud services (Dropbox, OneDrive Personal, temp.sh) to blend with normal traffic.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0755
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-stock-exchange-espionage-tl-2026-0755.webp?v=57d935ec (Threadlinqs threat intel: Stock Exchange Espionage Via OST Theft: Detection & IOCs (TL-2026-0755) — High severity, 45 IOCs, 9 detection rules.)
- **ID:** TL-2026-0755
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 45 (3 shown free below)

## Description

Symantec/Security.com documented a long-dwell, highly disciplined espionage intrusion targeting a senior executive at a major global stock exchange. First malicious activity was observed on 10 October 2025, by which point the attackers had already achieved local privilege escalation and deployed at least two masquerading binaries; the operation continued until at least 19 March 2026, giving an approximate five-month dwell time.

The core objective was theft of the victim's Outlook mailbox. The actor deployed a custom OST stealer that wrapped the legitimate Aspose .NET email library inside a bespoke executable (delivered as ts_9ea0.tmp, ts_e0d5.tmp and ts_e2d5.tmp - all sharing an identical SHA256). The stealer converted offline OST cache files to PST and used date-range windows (a -t flag) to extract mail incrementally: the first run pulled everything from August 2025 onward, while subsequent runs (approximately 12 extraction cycles over five months) captured only recent days. This incremental approach deliberately avoided large, alert-triggering uploads.

The attackers ran as SYSTEM through the Service Control Manager; malicious binaries spawned by wininit.exe confirm that LOCAL privilege escalation had been achieved before observation began. Persistence was layered across multiple masquerading binaries and scheduled tasks impersonating Adobe ARM, Microsoft OneDrive sync, and Lenovo CheckServerHealth services, with batch files (1.bat-5.bat) in c:\windows\temp\ re-registering tasks at varying intervals (3, 5, 300, 900 and 1440 minutes) to guarantee continuous execution.

Exfiltration relied entirely on legitimate, allow-listed cloud infrastructure used via curl: a persistent Dropbox OAuth2 application (client_id/client_secret reused, only authorization codes rotated) uploading to content.dropboxapi.com; OneDrive Personal, which after an initial DNS-based attempt against onedrive.live.com switched to hard-coded Microsoft IP addresses (13.107.137.11, 150.171.41.11) to avoid DNS queries; and brief experimentation with temp.sh (51.91.79.17) over three HTTPS connections before abandonment. Supporting tooling included SharpDecryptPwd and Impacket secretsdump for credential access, FRPC (Fast Reverse Proxy Client) for tunneling/C2, and bypassuac.exe variants for UAC bypass. The likely motivation is espionage against non-public market information - listings, enforcement actions, or market-moving events.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1053.005 Scheduled Task
- T1569.002 Service Execution
- T1053.005 Scheduled Task
- T1546.015 Component Object Model Hijacking
- T1543.003 Windows Service
- T1078 Valid Accounts
- T1548.002 Bypass User Account Control
- T1134 Access Token Manipulation
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1036.003 Rename Legitimate Utilities
- T1218 System Binary Proxy Execution
- T1078 Valid Accounts
- T1003.002 Security Account Manager
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1563 Remote Service Session Hijacking
- T1114.001 Local Email Collection
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1090.001 Internal Proxy
- T1572 Protocol Tunneling
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1567.002 Exfiltration to Cloud Storage
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Non-Outlook Process Reading OST Offline Cache / OST-to-PST Conversion — Exploitation** (`TL-2026-0755-SPL-001`)

Detects the campaign's core mailbox-theft mechanic: an Aspose-wrapped stealer (delivered as ts_*.tmp) reading the victim's Outlook OST offline cache and writing PST output, performed by a process other than outlook.exe. Correlates file access to *.ost / *.pst by non-Outlook images and the staging of ts_*.tmp markers in c:\windows	emp. This is local email collection (T1114.001) and data-from-local-system (T1005), the highest-fidelity early signal of the intrusion.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1114.001, T1005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=1)
| where (like(TargetFilename, "%.ost") OR like(TargetFilename, "%.pst") OR like(TargetFilename, "%\\windows\\temp\\ts_%.tmp"))
| eval proc=lower(coalesce(Image, ""))
| search NOT proc IN ("*\\outlook.exe", "*\\onedrive.exe", "*\\searchindexer.exe", "*\\searchprotocolhost.exe")
| eval suspicious_temp=if(like(TargetFilename,"%\\windows\\temp\\ts_%.tmp"),1,0)
| stats count, values(TargetFilename) as files, values(Image) as images, min(_time) as first_seen, max(_time) as last_seen by Computer, proc
| where count >= 1
| sort - count
```

### Microsoft KQL

```kql
// Non-Outlook process touching OST/PST cache or staging ts_*.tmp stealer markers
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName endswith ".ost" or FileName endswith ".pst"
        or FolderPath has @"\windows\temp\" and FileName startswith "ts_" and FileName endswith ".tmp")
| extend Proc = tolower(InitiatingProcessFileName)
| where Proc !in ("outlook.exe", "onedrive.exe", "searchindexer.exe", "searchprotocolhost.exe", "backup.exe")
| project Timestamp, DeviceName, Proc, InitiatingProcessFolderPath, FileName, FolderPath, ActionType, InitiatingProcessCommandLine
| sort by Timestamp desc
```

### Sigma

```yaml
title: Non-Outlook Process Accessing Outlook OST Offline Cache
id: 3f2b1c64-0a55-4e91-9d77-0755ostread01
status: experimental
description: Detects an OST/PST offline mailbox cache being read or written by a process other than Outlook, matching the TL-2026-0755 Aspose-based OST-to-PST stealer.
references:
    - https://www.security.com/threat-intelligence/stock-exchange-espionage
    - https://attack.mitre.org/techniques/T1114/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/10
tags:
    - attack.collection
    - attack.t1114.001
    - attack.t1005
logsource:
    product: windows
    category: file_access
detection:
    selection:
        FileName|endswith:
            - '.ost'
            - '.pst'
    filter_legit:
        Image|endswith:
            - '\outlook.exe'
            - '\OneDrive.exe'
            - '\SearchIndexer.exe'
            - '\SearchProtocolHost.exe'
    condition: selection and not filter_legit
falsepositives:
    - Backup or mail-archiving agents that legitimately read OST/PST files
    - eDiscovery or migration tooling
level: high
```

**Known false positives:**

- Enterprise backup or mail-archiving agents reading OST/PST files
- eDiscovery, indexing, or mailbox-migration tooling accessing offline caches

**Tuning notes:** Allow-list your sanctioned backup/archive/index binaries by full signed path rather than image name to prevent masquerade evasion. Raise severity when the accessing process also wrote a ts_*.tmp marker in c:\windows	emp in the same session.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Incremental OST-to-PST Extraction by ts_*.tmp Stealer with Date-Range Window — Exploitation (locked: unlock with TL Creds)
- SYSTEM Binary Spawned by wininit.exe from Vendor Masquerade Path + Credential Dumping — Post-Exploitation (locked: unlock with TL Creds)
- FRPC Reverse-Proxy Tunneling / Internal Proxy C2 — Command and Control (locked: unlock with TL Creds)
- Staging of ts_*.tmp Stealer Markers and Incremental PST Batches in Temp — Exploitation (locked: unlock with TL Creds)
- Batch-File Re-Registration of Masquerading Scheduled Tasks — Post-Exploitation (locked: unlock with TL Creds)
- DNS-less Outbound to Hard-coded Microsoft / [indicator] Exfil IPs — Exfiltration (locked: unlock with TL Creds)
- Masquerading Scheduled Task Impersonating Vendor Service Paths at Short Intervals — Post-Exploitation (locked: unlock with TL Creds)
- curl LOLBin Cloud Exfiltration with OAuth2 Bearer Token / Hard-coded Microsoft IPs — C2 & Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 45)

Defanged, TLP:CLEAR.

- IP address: `13.107.137[.]11`
- Domain: `content[.]dropboxapi[.]com`
- File hash: `db59813e3f27fb8608a4876e758f60b69d9700dc22d15237ac095bb3166fb622`

Full set of 45 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Espionage Campaign Against Stock Exchange Executive](https://www.security.com/threat-intelligence/stock-exchange-espionage)
- [MITRE ATT&CK T1114 - Email Collection](https://attack.mitre.org/techniques/T1114/)
- [MITRE ATT&CK T1567.002 - Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002/)
- [MITRE ATT&CK T1053.005 - Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK T1036.005 - Masquerading: Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005/)
- [Impacket (secretsdump) - Fortra/SecureAuth](https://github.com/fortra/impacket)
- [FRP - Fast Reverse Proxy (FRPC)](https://github.com/fatedier/frp)
- [Aspose.Email for .NET (OST/PST library abused by stealer)](https://products.aspose.com/email/net/)
- [SharpDecryptPwd - credential recovery tool](https://github.com/RowTeam/SharpDecryptPwd)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0755